User's Guide

Fingerprints Based on a Destination Address
115 of 218
Fingerprints Based on a Destination Address
In both of the previous examples, you created a new custom fingerprint to cover
a case where no appropriate fingerprint existed. You may also want to create a
new fingerprint for traffic flows already identified as one application, but should
be categorized as something else.
For example, let's say you have a Git repository on your network. Git repositories
(a source code management system used in software development) are
frequently accessed via SSH on port 22 (the standard TCP port assigned for SSH
traffic). In this case, the SSH traffic flows is identified using the system SSH port-
based fingerprint.
But what if you would like to more closely monitor who is accessing the Git
repository? If you know you are running the Git server on a certain system
(10.20.117.102 port 22, for our example), you can create a custom fingerprint to
identify the Git traffic flows.
The fingerprint is based on one of the SSH flows using the IP address/port of the
Git server and have a higher confidence than the system port-based fingerprint.
The higher confidence fingerprint will override the lower confidence fingerprint
when determining a match for the traffic flow.
Use the following steps to create the fingerprint.
1. Select the Analytics tab in Extreme Management Center.
2. Select the Application Flows tab.
3. In the table, right-click on an SSH port-based flow with the Git server destination
address and select Fingerprints > Add Fingerprint.